Feeds

Whatever happened to PGP?

Is PGP still pretty good for identity?

Top 5 reasons to deploy VMware with Tegile

PGP is often thought of as an encryption system, but your private key is a digital signature that can prove who your message comes from, as well as showing that it hasn’t been tampered with.

The reason a Public Key Infrastructure doesn’t look like a widespread identity system is that it needs a web of trust; if somebody you know has signed my PGP key, then you take their word that I am who I say I am. That works well for close groups of friends – or for the corporations and government departments around the world who rely on PKIs based on the commercial PGP offerings or the OpenPGP SDK that’s now available.

That’s where PGP has really made its mark, says Jon Callas (now the CTO of PGP Corporation; and part of the team that shepherded the commercial side of PGP out of the wilderness where Network Associates left it). “We thought it would be a grass roots system.

But now it’s really corporations setting up PKIs for their own business reasons. The entities are organisations like BMW or Siemens rather than individuals.” Some of the companies who failed to sell PKIs in the past had bad business models that were too expensive: “it was like buying a camera and having to buy 1,000 rolls of film at the same time”.

The OpenPGP standard is one of the things that’s helped PGP become more widespread; the other is the rise of systems that need to identify people on many different platforms. But PGP doesn’t solve all of the problems for that. The Friend of a Friend project (FOAF) uses digital signatures to attach PGP key IDs that verify the email of the address of the author to documents; you still have to decide for yourself if you trust the author which the PGP key identifies. There’s a PKI at the heart of Skype, for example, to make sure you’re talking to the person you want to call. But that tells you nothing about anything else to do with their identity.

PGP software is mature and the technology is both tested and flexible; you can use an LDAP server as a PGP keyserver or use the PGPticket protocol to issue secure authorisations instead of vulnerable passwords for access to a network service.

What many people want to do with identity now means making those identities work more widely. That comes down to the architecture of the systems that will accept identities, and the ways those identities are secured will include PGP (read more about PGP Identity Management here).

Identity management is changing into claims management and different claims will come from different systems, bringing together claims like your Skype ID, your age and your eBay ranking only when someone needs to know you’re old enough to buy what they’re selling before they call you. Some of those claims will be secured and verified by PGP.

Instead of building up as much information about your users as possible – something marketing departments are happier about than the users themselves – you can think about the smallest pieces of information you need for a specific authorisation or transaction.

Whether it’s issues of liability or commercial advantage, businesses don’t want to share more of their customer database than they have to, Callas points out. Ironically, their commercial interests are turning out to enable our desire for privacy. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.